# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=804 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 805 --- ## [Elasticsearch cluster going down , whenever trying to run query for more than 2 days](https://discuss.elastic.co/t/elasticsearch-cluster-going-down-whenever-trying-to-run-query-for-more-than-2-days/249309)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 6\ **Last updated:** [September 21, 2020, 1:52pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-going-down-whenever-trying-to-run-query-for-more-than-2-days/249309 "2020-09-21T13:52:20Z")
Hi All, I am new to elasticsearch, so don't much idea about it's performance, but whenever I am trying to run a visualization report for more than 2 days then it is resulting in cluster going down. We have some huge loa… --- ## [Strange behavior of s3 snapshots](https://discuss.elastic.co/t/strange-behavior-of-s3-snapshots/249367)
**Author:** [@aros](https://discuss.elastic.co/u/aros)\ **Replies:** 0\ **Last updated:** [September 21, 2020, 1:40pm UTC](https://discuss.elastic.co/t/strange-behavior-of-s3-snapshots/249367 "2020-09-21T13:40:38Z")
Hi, we lately encounters some strange behavoir of our s3 snapshots. We backup indices to wasabi using the s3 repository plugin with several repositories and slm policies registered. Each repository is registered once at… --- ## [Allow vector functions in script fields context](https://discuss.elastic.co/t/allow-vector-functions-in-script-fields-context/247884)
**Author:** [@Denne](https://discuss.elastic.co/u/Denne)\ **Replies:** 3\ **Last updated:** [September 21, 2020, 1:32pm UTC](https://discuss.elastic.co/t/allow-vector-functions-in-script-fields-context/247884 "2020-09-21T13:32:30Z")
Hi! I use for a very specific use case script fields for scoring different attributes of documents using custom painless scripts, where the query context is used for filtering non-relevant documents (in the example bel… --- ## [Strange results with lte range comparison for dates in ES 6.5.0](https://discuss.elastic.co/t/strange-results-with-lte-range-comparison-for-dates-in-es-6-5-0/247855)
**Author:** [@Jeremy\_LHEZ](https://discuss.elastic.co/u/Jeremy_LHEZ)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 1:11pm UTC](https://discuss.elastic.co/t/strange-results-with-lte-range-comparison-for-dates-in-es-6-5-0/247855 "2020-09-21T13:11:48Z")
Hello, I am trying to add a filter to some of my queries to make sure my results are contained in a specific date interval. My complete final query (executed in kibana) looks like this: { "query":{ … --- ## [Installing the SentiNL plugin](https://discuss.elastic.co/t/installing-the-sentinl-plugin/249352)
**Author:** [@kennedy](https://discuss.elastic.co/u/kennedy)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 1:06pm UTC](https://discuss.elastic.co/t/installing-the-sentinl-plugin/249352 "2020-09-21T13:06:46Z")
Hi there , I'm using a docker-compose file for elasticsearch and kibana service. Its up and working. Now , in Kibana i want to include the sentiNL plugin . Please help me with how that can be done. --- ## [Getting total count based on collapsed value](https://discuss.elastic.co/t/getting-total-count-based-on-collapsed-value/249358)
**Author:** [@mohanaprakash](https://discuss.elastic.co/u/mohanaprakash)\ **Replies:** 0\ **Last updated:** [September 21, 2020, 12:39pm UTC](https://discuss.elastic.co/t/getting-total-count-based-on-collapsed-value/249358 "2020-09-21T12:39:22Z")
I am new to elastic search and i am trying to extract total number of concurrent users active in the given period. For example i have a data as below User Login Time Logout Time A 2020-09-21T10:00:00 2020-09-21… --- ## [Alternative lucene query to implement rate() function in elasticsearch](https://discuss.elastic.co/t/alternative-lucene-query-to-implement-rate-function-in-elasticsearch/249143)
**Author:** [@Sankpra34](https://discuss.elastic.co/u/Sankpra34)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 11:59am UTC](https://discuss.elastic.co/t/alternative-lucene-query-to-implement-rate-function-in-elasticsearch/249143 "2020-09-21T11:59:45Z")
I need to convert my PromQL query from my Grafana dashboard into Elasticsearch supported Lucene's query. Currently, there is no such function that can be used as rate() function. Is there any way to implement rate() func… --- ## [Request failed with a 400 error. \[x\_content\_parse\_exception\] Failed to build \[xpack/rollup/jobconfig\] after last required field arrived](https://discuss.elastic.co/t/request-failed-with-a-400-error-x-content-parse-exception-failed-to-build-xpack-rollup-jobconfig-after-last-required-field-arrived/249252)
**Author:** [@piyalkuet](https://discuss.elastic.co/u/piyalkuet)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 11:53am UTC](https://discuss.elastic.co/t/request-failed-with-a-400-error-x-content-parse-exception-failed-to-build-xpack-rollup-jobconfig-after-last-required-field-arrived/249252 "2020-09-21T11:53:58Z")
Dear all, I am facing issues creating a rollup job for big indexes. While saving it gives me a exception "Request failed with a 400 error. \[x\_content\_parse\_exception\] Failed to build \[xpack/rollup/jobconfig\] after last r… --- ## [How can I search for word parts with operator AND](https://discuss.elastic.co/t/how-can-i-search-for-word-parts-with-operator-and/249342)
**Author:** [@MartinD](https://discuss.elastic.co/u/MartinD)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 11:46am UTC](https://discuss.elastic.co/t/how-can-i-search-for-word-parts-with-operator-and/249342 "2020-09-21T11:46:26Z")
I have a field in my index which is using hyphenation decompounder for german. When I index a document with the value "Anfrage-7078437-991506 (1).P93" this leads to the tokens "Anfrage", "frage", "7078437", "991506", "1… --- ## [Cluster RED, unassigned shards](https://discuss.elastic.co/t/cluster-red-unassigned-shards/248951)
**Author:** [@alkarp](https://discuss.elastic.co/u/alkarp)\ **Replies:** 3\ **Last updated:** [September 21, 2020, 10:42am UTC](https://discuss.elastic.co/t/cluster-red-unassigned-shards/248951 "2020-09-21T10:42:02Z")
After complete cluster restart have all the indices shards unassigned. 662 indices 820 shards in summary 3 master nodes 3 data nodes Master and data nodes are up, and it says "can\_allocate" : "yes", however shards s… --- ## [I need help: Search query for single custom object array with words and values sorted decending](https://discuss.elastic.co/t/i-need-help-search-query-for-single-custom-object-array-with-words-and-values-sorted-decending/249333)
**Author:** [@prox](https://discuss.elastic.co/u/prox)\ **Replies:** 0\ **Last updated:** [September 21, 2020, 9:54am UTC](https://discuss.elastic.co/t/i-need-help-search-query-for-single-custom-object-array-with-words-and-values-sorted-decending/249333 "2020-09-21T09:54:42Z")
I am currently troubled by creating an elasticsearch query that searches firstly the "customPayload", sort by the word value. It is currently enough if it only works with single word search terms. If possible I also want… --- ## [Replace string in a string field (Ingest Pipeline)](https://discuss.elastic.co/t/replace-string-in-a-string-field-ingest-pipeline/248553)
**Author:** [@BkQc](https://discuss.elastic.co/u/BkQc)\ **Replies:** 3\ **Last updated:** [September 21, 2020, 9:47am UTC](https://discuss.elastic.co/t/replace-string-in-a-string-field-ingest-pipeline/248553 "2020-09-21T09:47:32Z")
I have a field for which I would need to replace values by CrLf. I tried the following but \\r\\n is not recognized (unexpected character \[\\"\\\\r\]. The only valid escape sequences in strings starting with \[\\"\] a… --- ## [Unable to Disable G1 GC logging to stdout RHEL6](https://discuss.elastic.co/t/unable-to-disable-g1-gc-logging-to-stdout-rhel6/247291)
**Author:** [@lzukel](https://discuss.elastic.co/u/lzukel)\ **Replies:** 5\ **Last updated:** [September 21, 2020, 9:44am UTC](https://discuss.elastic.co/t/unable-to-disable-g1-gc-logging-to-stdout-rhel6/247291 "2020-09-21T09:44:20Z")
I am unable to disable the GC logging from Elasticsearch 7.x to stdout. elasticsearch startup command: /usr/share/elasticsearch/jdk//bin/java -Xshare:auto -Des.networkaddress.cache.ttl=60 -Des.networkaddress.cache.nega… --- ## [Question about ILM](https://discuss.elastic.co/t/question-about-ilm/249234)
**Author:** [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\ **Replies:** 6\ **Last updated:** [September 21, 2020, 9:17am UTC](https://discuss.elastic.co/t/question-about-ilm/249234 "2020-09-21T09:17:17Z")
Hi, I'm using a custom index in my filebeat so I had to disable ilm in elasticsearch. My question is if there is a automatic solution to delete indices older than 3 months when ilm is diabled? or maybe have a hot-cold … --- ## [How to chose the number of shards and replica](https://discuss.elastic.co/t/how-to-chose-the-number-of-shards-and-replica/249321)
**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\ **Replies:** 2\ **Last updated:** [September 21, 2020, 8:25am UTC](https://discuss.elastic.co/t/how-to-chose-the-number-of-shards-and-replica/249321 "2020-09-21T08:25:47Z")
Hello everybody, Could you tell me please what is the best rule to calculate the number of shards for the index ? I found this rule but I don't know if it's the best one: 20 Shards max for each 1 GB of heap on each nod… --- ## [How to convert default index template from 5.6 to 7.9?](https://discuss.elastic.co/t/how-to-convert-default-index-template-from-5-6-to-7-9/249112)
**Author:** [@jze](https://discuss.elastic.co/u/jze)\ **Replies:** 3\ **Last updated:** [September 21, 2020, 8:10am UTC](https://discuss.elastic.co/t/how-to-convert-default-index-template-from-5-6-to-7-9/249112 "2020-09-21T08:10:00Z")
Hello, I have from ELK 5.6 stack this default index template definition: PUT /\_template/mytemplate { "template":".kibana-\*", "settings":{ "number\_of\_shards":1 }, "mappings":{ "config":{ … --- ## [Bulk API "lies" in the response](https://discuss.elastic.co/t/bulk-api-lies-in-the-response/248674)
**Author:** [@JulGor](https://discuss.elastic.co/u/JulGor)\ **Replies:** 7\ **Last updated:** [September 21, 2020, 7:53am UTC](https://discuss.elastic.co/t/bulk-api-lies-in-the-response/248674 "2020-09-21T07:53:28Z")
Hello, I'm having some problems using the Bulk API because it is lying in the response it returns. I'm using the following request: POST /\_bulk?refresh=true { "index": { "\_index": "my\_index", "\_id": 123 } }, … --- ## [Transform invalid date values](https://discuss.elastic.co/t/transform-invalid-date-values/249308)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 7:26am UTC](https://discuss.elastic.co/t/transform-invalid-date-values/249308 "2020-09-21T07:26:20Z")
Hello, I have the following group by in my transform: "pivot": { "group\_by": { "datetime": { "date\_histogram": { "field": "datetime", "calendar\_interval": "1m" } }, … --- ## [How to get sample data which is used in demo.elastic.co?](https://discuss.elastic.co/t/how-to-get-sample-data-which-is-used-in-demo-elastic-co/249247)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 2\ **Last updated:** [September 21, 2020, 6:55am UTC](https://discuss.elastic.co/t/how-to-get-sample-data-which-is-used-in-demo-elastic-co/249247 "2020-09-21T06:55:57Z")
hi We could see the demo.elastic.co has quite good dataset to simulate SIEM/APM etc. eg. https://demo.elastic.co/app/siem#/detections/signals Would like to understand How to get hold of these sample data? Is it ope… --- ## [Rolling upgrade - can't revert... :-(](https://discuss.elastic.co/t/rolling-upgrade-cant-revert/249306)
**Author:** [@HarelM](https://discuss.elastic.co/u/HarelM)\ **Replies:** 2\ **Last updated:** [September 21, 2020, 6:28am UTC](https://discuss.elastic.co/t/rolling-upgrade-cant-revert/249306 "2020-09-21T06:28:39Z")
OK, so I started an attempt to upgrade my elasticsearch node. I had one node with 5.6.3 version and a few indices. I added another node with version 6.8.12. I Reindexed all my indices and added a prefix 6-8 so that ne… --- ## [Template index\_pattern matching](https://discuss.elastic.co/t/template-index-pattern-matching/249289)
**Author:** [@szanin](https://discuss.elastic.co/u/szanin)\ **Replies:** 2\ **Last updated:** [September 21, 2020, 4:02am UTC](https://discuss.elastic.co/t/template-index-pattern-matching/249289 "2020-09-21T04:02:53Z")
How do I ensure that only new indices get my template, and not the metrics or logs indices. If I define the "index\_pattern" to be "\*" that will apply to all new indices. Is there a way to specify that I don't want to app… --- ## [Defining index mappings on ElasticSearch](https://discuss.elastic.co/t/defining-index-mappings-on-elasticsearch/248774)
**Author:** [@szanin](https://discuss.elastic.co/u/szanin)\ **Replies:** 5\ **Last updated:** [September 21, 2020, 3:32am UTC](https://discuss.elastic.co/t/defining-index-mappings-on-elasticsearch/248774 "2020-09-21T03:32:18Z")
Hi there, This is my first post here, so I apologise in advance if I'm not too clear or if my question has been asked already. I have ElasticSearch running in a Docker cluster, I use it to search through a ASP.NET core… --- ## [How to calculate time difference across multi-layer nested structure](https://discuss.elastic.co/t/how-to-calculate-time-difference-across-multi-layer-nested-structure/248794)
**Author:** [@Fan\_Y102](https://discuss.elastic.co/u/Fan_Y102)\ **Replies:** 2\ **Last updated:** [September 21, 2020, 1:51am UTC](https://discuss.elastic.co/t/how-to-calculate-time-difference-across-multi-layer-nested-structure/248794 "2020-09-21T01:51:07Z")
Hello Guys, I'm new for Elasticsearch query. Currently, I'm working on a data set contains two layers nested JSON. For example: { "data": \[ { "number": 1, "startDate": "2020-01-08", "finalDate": "2020-01-04", … --- ## [Automate rollover for daily indices using ILM](https://discuss.elastic.co/t/automate-rollover-for-daily-indices-using-ilm/249233)
**Author:** [@Akshay\_Pawar](https://discuss.elastic.co/u/Akshay_Pawar)\ **Replies:** 5\ **Last updated:** [September 20, 2020, 10:12pm UTC](https://discuss.elastic.co/t/automate-rollover-for-daily-indices-using-ilm/249233 "2020-09-20T22:12:57Z")
Hello, I am looking into automating rollover using Index lifecycle management for daily indices. I am looking for the pattern as follows so that I would be seamlessly able to search across all three indices rollove… --- ## [Error: Could not find or load main class org.elasticsearch.bootstrap.Elasticsearch - Windows Server 2012 R2 - ElasticSearch 2.1.1](https://discuss.elastic.co/t/error-could-not-find-or-load-main-class-org-elasticsearch-bootstrap-elasticsearch-windows-server-2012-r2-elasticsearch-2-1-1/248921)
**Author:** [@silo](https://discuss.elastic.co/u/silo)\ **Replies:** 1\ **Last updated:** [September 20, 2020, 9:39pm UTC](https://discuss.elastic.co/t/error-could-not-find-or-load-main-class-org-elasticsearch-bootstrap-elasticsearch-windows-server-2012-r2-elasticsearch-2-1-1/248921 "2020-09-20T21:39:26Z")
I am facing this error when i tried to run elasticsearch.bat file. I have verified the JAVA\_HOME environment variable. But still the above error persists. --- ## [Index template and JVM usage](https://discuss.elastic.co/t/index-template-and-jvm-usage/249071)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 1\ **Last updated:** [September 20, 2020, 9:36pm UTC](https://discuss.elastic.co/t/index-template-and-jvm-usage/249071 "2020-09-20T21:36:21Z")
Hi, We have a number of indexs for devices with limited static fields, ie a firewall. (assuming an upgrade of the device does not add more fields) I typically use the ECS as the template for the indexs. Would there b… --- ## [Elasticsearch node not responding (ES OSS version 7.6.1)](https://discuss.elastic.co/t/elasticsearch-node-not-responding-es-oss-version-7-6-1/249127)
**Author:** [@DineshNaik](https://discuss.elastic.co/u/DineshNaik)\ **Replies:** 1\ **Last updated:** [September 20, 2020, 9:30pm UTC](https://discuss.elastic.co/t/elasticsearch-node-not-responding-es-oss-version-7-6-1/249127 "2020-09-20T21:30:21Z")
We have an elasticsearch cluster with 3 master and 6 data nodes . Elasticsearch version is 7.6.1(OSS). one of the data node is becoming non-responsive and none of API's (like \_cat, \_cluster/health etc) are working when … --- ## [Storage level in Elasticsearch cluster](https://discuss.elastic.co/t/storage-level-in-elasticsearch-cluster/249196)
**Author:** [@the\_brimix](https://discuss.elastic.co/u/the_brimix)\ **Replies:** 1\ **Last updated:** [September 20, 2020, 9:28pm UTC](https://discuss.elastic.co/t/storage-level-in-elasticsearch-cluster/249196 "2020-09-20T21:28:15Z")
Hi I've a Elasticsearch cluster with 5 nodes. I've this used storage repartition: Node1: 76% Node2: 94% Node3: 88% Node4: 73% Node5: 74% How to do to "leveling" the used storage ? For the node 2 et 3, We arrived … --- ## [ElasticSearch - how to use search-as-you-type for multivalued fields](https://discuss.elastic.co/t/elasticsearch-how-to-use-search-as-you-type-for-multivalued-fields/249270)
**Author:** [@Ondra\_N](https://discuss.elastic.co/u/Ondra_N)\ **Replies:** 0\ **Last updated:** [September 20, 2020, 5:59pm UTC](https://discuss.elastic.co/t/elasticsearch-how-to-use-search-as-you-type-for-multivalued-fields/249270 "2020-09-20T17:59:37Z")
I am messing around with the newly added search-as-you-type field type. Having documents with following structure doc\_1 ... "nickname": \["Super", "Terrible", "Mediocre"\] ... doc\_2 ... "nickname": \["Grande", "Perfect"… --- ## [Reindexing a document with same version number but with different metadata](https://discuss.elastic.co/t/reindexing-a-document-with-same-version-number-but-with-different-metadata/249268)
**Author:** [@vishnuk](https://discuss.elastic.co/u/vishnuk)\ **Replies:** 1\ **Last updated:** [September 20, 2020, 5:25pm UTC](https://discuss.elastic.co/t/reindexing-a-document-with-same-version-number-but-with-different-metadata/249268 "2020-09-20T17:25:07Z")
Hi, I have the following use case. An admin indexes the existing system during a small maintenance window , all good to go. We plan to use an external version for index document version Users starts using the system a… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=803) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=805)